82 lines
2.4 KiB
YAML
82 lines
2.4 KiB
YAML
services:
|
|
netbird:
|
|
image: netbirdio/netbird:${NETBIRD_VERSION:-latest}
|
|
container_name: netbird-public-proxy
|
|
hostname: ${NETBIRD_PEER_NAME:-public-proxy}
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
cap_add:
|
|
- NET_ADMIN
|
|
- SYS_ADMIN
|
|
- SYS_RESOURCE
|
|
devices:
|
|
- /dev/net/tun:/dev/net/tun
|
|
environment:
|
|
NB_SETUP_KEY: ${NETBIRD_SETUP_KEY:?NETBIRD_SETUP_KEY is required}
|
|
NB_MANAGEMENT_URL: ${NETBIRD_MANAGEMENT_URL:?NETBIRD_MANAGEMENT_URL is required}
|
|
NB_LOG_LEVEL: ${NETBIRD_LOG_LEVEL:-info}
|
|
volumes:
|
|
- netbird-client:/var/lib/netbird
|
|
|
|
edgeguard:
|
|
image: ${EDGEGUARD_IMAGE:?EDGEGUARD_IMAGE is required}:${EDGEGUARD_VERSION:-latest}
|
|
container_name: sessionguard-edgeguard
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
depends_on:
|
|
- netbird
|
|
command:
|
|
- -config
|
|
- /etc/sessionguard-edgeguard/edgeguard.json
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
tmpfs:
|
|
- /tmp:size=16m,noexec,nosuid,nodev
|
|
volumes:
|
|
- ./edgeguard.json:/etc/sessionguard-edgeguard/edgeguard.json:ro
|
|
- ./blacklist.txt:/etc/sessionguard-edgeguard/blacklist.txt:ro
|
|
- ./rate-exempt.txt:/etc/sessionguard-edgeguard/rate-exempt.txt:ro
|
|
- edgeguard-state:/var/lib/sessionguard-edgeguard
|
|
|
|
caddy:
|
|
image: caddy:${CADDY_VERSION:-2.11.4}
|
|
container_name: caddy-public
|
|
restart: unless-stopped
|
|
network_mode: host
|
|
depends_on:
|
|
- netbird
|
|
- edgeguard
|
|
environment:
|
|
ACME_EMAIL: ${ACME_EMAIL:?ACME_EMAIL is required}
|
|
GUAC_HOST: ${GUAC_HOST:-ts.hilden.info}
|
|
SESSIONGUARD_HOST: ${SESSIONGUARD_HOST:-sessionguard.hilden.info}
|
|
GUAC01_IP: ${GUAC01_IP:?GUAC01_IP is required}
|
|
GUAC02_IP: ${GUAC02_IP:?GUAC02_IP is required}
|
|
GUAC03_IP: ${GUAC03_IP:?GUAC03_IP is required}
|
|
SESSIONGUARD_IP: ${SESSIONGUARD_IP:?SESSIONGUARD_IP is required}
|
|
GUAC_LB_SECRET: ${GUAC_LB_SECRET:?GUAC_LB_SECRET is required}
|
|
read_only: true
|
|
cap_drop:
|
|
- ALL
|
|
cap_add:
|
|
- NET_BIND_SERVICE
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
tmpfs:
|
|
- /tmp:size=64m,noexec,nosuid,nodev
|
|
volumes:
|
|
- ./Caddyfile:/etc/caddy/Caddyfile:ro
|
|
- caddy-data:/data
|
|
- caddy-config:/config
|
|
- caddy-logs:/var/log/caddy
|
|
|
|
volumes:
|
|
netbird-client:
|
|
edgeguard-state:
|
|
caddy-data:
|
|
caddy-config:
|
|
caddy-logs:
|